ZITADEL race condition in lockout policy execution

CVE-2023-47111

What is CVE-2023-47111?

The ZITADEL Identity Infrastructure allows administrators to set a Lockout Policy that limits the number of failed password attempts. However, due to a flaw in its implementation, an attacker can execute multiple simultaneous password checks, effectively circumventing the intended limits of the Lockout Policy. This vulnerability could lead to unauthorized access attempts, increasing the risk of successful attacks against user accounts. The issue has been addressed in versions 2.40.5 and 2.38.3, which include patches to mitigate this risk.

References